Harvest now, decrypt later: the reason the clock is already running
Encrypted data recorded today can be decrypted years from now once a quantum computer exists. That turns a future capability into a present-day exposure for anything with a long shelf life.
The single most important idea in post-quantum planning is that the attack does not have to happen in real time. An adversary who can observe your network records the encrypted traffic and the key-exchange messages, then archives them. Storage is cheap and patience is free. When a cryptographically relevant quantum computer becomes available, they replay the archive and recover the keys retroactively — and every message sent under those keys becomes readable.
Whose data is actually at risk
Not everything needs protecting for decades. The useful test is a simple inequality usually credited to Michele Mosca. Let X be how many years a secret must remain confidential, Y the years it will take you to migrate to post-quantum cryptography, and Z the years until a quantum computer can break today's algorithms. If X plus Y is greater than Z, the data is still sensitive at the moment it becomes decryptable — so it is already at risk.
- **High shelf life (act first):** health and genetic records, biometric identifiers, state and trade secrets, long-term contracts, source code and signing keys.
- **Low shelf life (lower priority):** session cookies, one-time tokens, ephemeral messages whose value expires in minutes or days.
Sort by shelf life, not by system
The instinct is to migrate the busiest systems first. Harvest-now-decrypt-later says to migrate the longest-lived secrets first, because those are the ones for which retroactive decryption still causes damage. Data lifetime, not traffic volume, sets the order.
Why signatures are different
Harvest-now-decrypt-later applies to confidentiality — to key exchange and encryption. It does not apply the same way to digital signatures, because a forged signature is only useful once the quantum computer exists; you cannot forge a document retroactively into the past. That is why the first concrete migration step almost everyone takes is protecting key exchange — typically by moving TLS to a hybrid post-quantum handshake — while signature migration follows on a somewhat less frantic schedule.
For the full threat model and the maths of the exposure window, see the in-depth guide, Harvest now, decrypt later.